Posts tagged with ""
A practical, month-by-month approach to small practice HIPAA compliance for offices with no dedicated compliance staff — what to document, who owns it, and which deadlines actually bite.
Carl B. Johnson
The Privacy Rule requires you to name one person and document it. Here is what that person owes you every month, every deadline they own, and the paper trail that proves the job is actually being done.
Carl B. Johnson
The Security Rule creates the Security Officer role in one sentence and then hands that person a dozen jobs. Here is what those duties actually look like in a working practice, with timelines and the evidence an auditor asks for.
Carl B. Johnson
HIPAA names two required officials and gives them specific, dated obligations. Here is what those duties look like on a calendar, in a file cabinet, and during an OCR investigation.
Carl B. Johnson
No federal agency certifies HIPAA compliance. Here's what the certificate on your vendor's website actually means, what OCR asks for during an investigation, and how to build the evidence file that survives one.
Carl B. Johnson
A school district asks for a student's chart. Whether HIPAA or FERPA controls that record changes who signs, what you may release, and what documentation you keep on file.
Carl B. Johnson
A medical assistant forwards chart screenshots to the state health department. Here is what 45 CFR 164.502(j) actually permits, what 160.316 forbids you from doing next, and the documentation that proves you handled it correctly.
Carl B. Johnson
Patients can complain to you and to the HHS Office for Civil Rights. Here's how the HIPAA complaint process actually unfolds, what OCR asks for, and the records your practice needs on file before the letter arrives.
Carl B. Johnson
Fax is still the default channel for referrals, prior auth, and records requests. Here is what a HIPAA compliant fax setup actually requires — vendor BAA terms, workflow controls, and the documentation an OCR investigator will ask for.
Carl B. Johnson
Your Security Rule obligation isn't to prevent every incident — it's to have a documented, tested response. Here are the roles, the clocks, and the evidence file that survives an OCR request.
Carl B. Johnson